Why does Data Privacy Basics (GDPR/CCPA) matter?
This is one of the few areas where "we'll deal with it later" is not a neutral delay. The obligations attach the moment you collect personal data from a covered person, regardless of company size or funding stage, and retrofitting compliance into a product built without it in mind (data scattered across systems with no record of consent or deletion path) is far more expensive than designing for it from the start. It also becomes a due-diligence item the moment you raise from investors or sign an enterprise customer, both of whom will ask, and a vague answer reads as a real risk rather than an early-stage excuse.
What does Data Privacy Basics (GDPR/CCPA) look like in practice?
Suppose the scheduling product stores patient names and appointment history to power reminders. If any patient is an EU resident, GDPR applies to the practice's use of the product regardless of where the company is headquartered, and the product needs a documented basis for processing that data, a way to delete a person's data on request, and a record of what's stored where. Building that path after a hundred practices are already live means reconstructing where patient data ended up across logs, backups, and analytics tools, a much larger project than including a deletion function in the schema from the first migration.
What are the common mistakes with Data Privacy Basics (GDPR/CCPA)?
- Assuming privacy law doesn't apply because the company is small or pre-revenue, obligations attach to the data, not the company's size.
- Collecting more personal data than the product actually needs, which expands what has to be protected and disclosed for no product benefit.
- Having no way to actually delete a person's data on request, only a way to hide it from the UI.
- Treating the terms of service and privacy policy as legal boilerplate rather than as a document that has to match what the product actually does with data.
Where the term comes from
The CCPA exists because of a ballot measure that was withdrawn. Alastair Mactaggart, a San Francisco real estate developer with no background in privacy, qualified a consumer privacy initiative for California's November 2018 ballot with roughly 629,000 signatures. In June 2018 he agreed to pull it in exchange for the legislature passing a negotiated version, which it did within a week.
Californians for Consumer Privacy ↗Related concepts
- Terms of Service and Privacy Policy BasicsThe terms of service set the legal rules for using the product (liability limits, what users may and may not do, dispute handling); the privacy policy is a legally required disclosure of what personal data is collected and how it is used. Both need to reflect what the product actually does, not a generic template.
- Incorporation Basics and the 83(b) ElectionIncorporating creates the legal entity that issues stock to founders; the 83(b) election is a filing, due within 30 days of receiving restricted stock, that lets founders pay tax on it now at its (typically negligible) current value instead of later as it vests and appreciates.
- Cybersecurity and Data Privacy DiligenceThe diligence workstream, distinct from a company's public-facing privacy policy, that examines a target's actual security practices, past breach or incident history, and data-handling compliance ahead of a financing or acquisition, because a buyer is inheriting both the data and the risk of how it has been protected.